Does url-shortening prevent XSS attack?

Question

Since document.cookie gets the current web page cookies, if I put my XSS payload in a URL shortener website, it will not work, right?

I mean it will get the cookies of that URL shortener website, not the target. Is this right?
I don't mean the URL shorteners are doing it on purpose, I mean is it a side effect of using short url?

Answer 1

URL shortener normally only redirects your request to a different server, they do not proxy that request. The idea of the URL shortener is to keep the complete URL and just make it shorter alias.

So it won't prevent XSS attack (at least not the majority of XSS attack types)

Answer 2

It depends on how your short url works. If your short url passing get parameter, your site still affected by XSS attack.

Usually XSS attack inject from url parameter. Especially if you load the parameter without any string escape and execute to html or run in javascript.